Starting from DirectAudit 3.1.1, shell /da/cdashmod is replaced with /bin/centrifyda. However, why /etc/shells still includes the line /da/cdashmod after upgraded to CDA 3.1.1?
The line /da/cdashmod was left inside /etc/shells after upgrading from an earlier versions. It's just an entry that is not going to be used by any software.